CVE-2024-26450

    Dashboard / Vulnerabilities / CVE-2024-26450

    CVE-2024-26450

    Published: 28 Feb 2024Last Modified: 12 Aug 2026

    Summary:

    Details: An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing remote JavaScript. This can be used to upload a new PHP file under an administrator and directly call that file from the victim's instance to connect back to a malicious listener.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26450.json, https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f, https://nvd.nist.gov/vuln/detail/CVE-2024-26450

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -67ffc6f4a3d50ed6a712c7f3f3fe624bbaf9ee8e

    Affected versions

    14.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-26450 | CVE-DB